Ambient: Document that PeerAuthentication mTLS.Mode = DISABLE is a no-op in ambient

[bleggett]

In sidecar, it used to be possible to globally disable mTLS for all workloads at the cluster or namespace level with PeerAuthentication.

In ambient, you can still create a PeerAuthentication policy at the mesh or namespace level that uses DISABLE, but it will be ignored. This is by design, as we do not support DISABLE in ambient - it is effectively an alias for PERMISSIVE.

If you want to drop mTLS for an entire namespace, unlabel the namespace for ambient capture instead, e.g. kubectl label namespace default istio.io/dataplane-mode-

We need to document this behavior, however.

[craigbox]

See also istio/api#3184